IN150.129.52.130 uploaded by a Telegram User

We've been tracking a notable uptick in stealer logs appearing on Telegram channels over the past month, often targeting very specific types of credentials or application data. What caught our attention with this particular leak wasn't the relatively low record count, but the specific targeting of internal infrastructure data – API hosts and endpoints alongside credentials. The setup here felt different because it pointed to a reconnaissance phase potentially targeting a specific organization or a small cluster of them.

IN150.129.52.130: The Stealer Log Exposing Internal Infrastructure Details

A stealer log file, uploaded by a Telegram user on May 11, 2025, exposed 548 records related to the endpoint IN150.129.52.130. These records contained a mix of email addresses, plaintext passwords, and crucially, URLs pointing to what appears to be internal API infrastructure. This breach caught our attention due to the potential for significant lateral movement within a compromised network, given the exposure of internal API endpoints. The combination of credentials and endpoint information could allow an attacker to bypass traditional perimeter defenses. This incident highlights the growing threat of stealer logs being used not just for broad credential harvesting, but for targeted attacks against specific organizations.

Breach Stats:
* Total records exposed: 548
* Types of data included: Email Addresses, Plaintext Passwords, URLs
* Sensitive content types: Potentially sensitive API endpoint data
* Source structure: Stealer log file
* Leak location: Telegram channel
* Date of first appearance: May 11, 2025

The rise of readily available stealer logs on platforms like Telegram is well documented. Threat actors are increasingly using these logs to automate reconnaissance and identify potential targets. A recent report by BleepingComputer highlighted the surge in stealer log marketplaces, noting that "the ease of access and low cost make these logs an attractive resource for novice and experienced attackers alike." The plaintext storage of passwords, as seen in this breach, further amplifies the risk.